Authentication — crptoX API

Bearer Authentication

Send your API secret in the Authorization header using the Bearer authentication scheme.

Authorization TEXT

Authorization: Bearer YOUR_API_SECRET

Example BASH

curl https://crptox.com/api/v1/invoices/INVOICE_UUID \
  -H "Authorization: Bearer YOUR_API_SECRET" \
  -H "Accept: application/json"

API Key Environments

Sandbox and Live credentials are separate. The prefix of the API key identifies the environment in which the request will be processed.


                            crx_test_...

Sandbox

Used for Sandbox requests and supported blockchain test networks.


                            crx_live_...

Live

Used for production requests and supported blockchain main networks.

Sandbox and Live Isolation

Sandbox and Live data are isolated. Invoices, wallets, blockchain transactions, and other payment data created in one environment are not available to the other.

The environment cannot be selected or overridden in the request body. crptoX always derives it from the authenticated API key.

Request Body JSON

{
  "network": "bsc",
  "asset": "usdt",
  "amount": "10.000000"
}

For example, the same network value can refer to a test network when authenticated with a crx_test_ key and its production network when authenticated with a crx_live_ key.

Sandbox Networks

Sandbox lets you run the complete payment lifecycle using supported test networks and test tokens.

TRON

Shasta

TRON Sandbox transactions are processed on the Shasta test network.

BSC

BSC Testnet

BSC Sandbox transactions are processed on BSC Testnet.

Sandbox tokens have no real monetary value. Make sure the wallet you configure belongs to the same test network you intend to use.

API Key Lifecycle

Treat API secrets as sensitive credentials throughout their lifecycle.

Store API secrets securely on your server and never expose them in browser-side code or public repositories.
Use Sandbox keys during development and testing, and Live keys only in production.
Revoke or replace a key immediately if you believe it has been exposed.
Use separate API keys for separate applications or integrations when operational isolation is useful.

Invalid Credentials

Requests made with an invalid, expired, revoked, or otherwise unusable API key are rejected.

HTTP 401 JSON

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API credentials."
  }
}

Security Recommendations

Never expose your API secret in frontend JavaScript, mobile application bundles, or other client-side code.
Store API secrets in environment variables or a secure secrets manager.
Always communicate with the crptoX API over HTTPS.
Keep Sandbox and Live credentials separate in your deployment configuration.
Rotate credentials when team access changes or whenever credential exposure is suspected.

Rate Limits

API requests may be rate limited to protect platform availability and prevent abusive traffic.

When the applicable rate limit is exceeded, the API returns an HTTP 429 response.

HTTP 429 JSON

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded."
  }
}